Mic92/stockholm
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

l: add lassulus-blog config, repair ssl for cgit

Browse Source
This commit is contained in:
lassulus 2016-10-19 14:58:46 +02:00
parent 7aa9fb7eff
commit e3cce01913
2 changed files with 92 additions and 48 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

49
lass/1systems/prism.nix
View File

@ -24,26 +24,6 @@ in {
../2configs/repo-sync.nix
../2configs/binary-cache/server.nix
../2configs/iodined.nix
{
imports = [
../2configs/git.nix
];
krebs.nginx.servers.cgit = {
server-names = [
"cgit.lassul.us"
];
locations = [
(nameValuePair "/.well-known/acme-challenge" ''
root /var/lib/acme/challenges/cgit.lassul.us/;
'')
];
ssl = {
enable = true;
certificate = "/var/lib/acme/cgit.lassul.us/fullchain.pem";
certificate_key = "/var/lib/acme/cgit.lassul.us/key.pem";
};
};
}
{
users.extraGroups = {
# ● systemd-tmpfiles-setup.service - Create Volatile Files and Directories
@ -174,6 +154,7 @@ in {
imports = [
../2configs/websites/wohnprojekt-rhh.de.nix
../2configs/websites/domsen.nix
../2configs/websites/lassulus.nix
];
krebs.iptables.tables.filter.INPUT.rules = [
{ predicate = "-p tcp --dport http"; target = "ACCEPT"; }
@ -186,34 +167,6 @@ in {
};
}
{
security.acme = {
certs."lassul.us" = {
email = "lass@lassul.us";
webroot = "/var/lib/acme/challenges/lassul.us";
plugins = [
"account_key.json"
"key.pem"
"fullchain.pem"
"full.pem"
];
allowKeysForGroup = true;
group = "lasscert";
};
};
users.groups.lasscert.members = [
"dovecot2"
"ejabberd"
"exim"
"nginx"
];
krebs.nginx.servers."lassul.us" = {
server-names = [ "lassul.us" ];
locations = [
(lib.nameValuePair "/.well-known/acme-challenge" ''
root /var/lib/acme/challenges/lassul.us/;
'')
];
};
lass.ejabberd = {
enable = true;
hosts = [ "lassul.us" ];

91
lass/2configs/websites/lassulus.nix Normal file
View File

@ -0,0 +1,91 @@
{ config, pkgs, lib, ... }:
with lib;
let
inherit (import <stockholm/krebs/4lib> { config = {}; inherit lib; })
genid
;
in {
imports = [
../git.nix
];
security.acme = {
certs."lassul.us" = {
email = "lass@lassul.us";
webroot = "/var/lib/acme/challenges/lassul.us";
plugins = [
"account_key.json"
"key.pem"
"fullchain.pem"
"full.pem"
];
allowKeysForGroup = true;
group = "lasscert";
};
certs."cgit.lassul.us" = {
email = "lassulus@gmail.com";
webroot = "/var/lib/acme/challenges/cgit.lassul.us";
plugins = [
"account_key.json"
"key.pem"
"fullchain.pem"
];
group = "nginx";
allowKeysForGroup = true;
};
};
users.groups.lasscert.members = [
"dovecot2"
"ejabberd"
"exim"
"nginx"
];
krebs.nginx.servers."lassul.us" = {
server-names = [ "lassul.us" ];
locations = [
(nameValuePair "/" ''
root /srv/http/lassul.us;
'')
(nameValuePair "/.well-known/acme-challenge" ''
root /var/lib/acme/challenges/lassul.us/;
'')
];
ssl = {
enable = true;
certificate = "/var/lib/acme/lassul.us/fullchain.pem";
certificate_key = "/var/lib/acme/lassul.us/key.pem";
};
};
krebs.nginx.servers.cgit = {
server-names = [
"cgit.lassul.us"
];
locations = [
(nameValuePair "/.well-known/acme-challenge" ''
root /var/lib/acme/challenges/cgit.lassul.us/;
'')
];
ssl = {
enable = true;
certificate = "/var/lib/acme/cgit.lassul.us/fullchain.pem";
certificate_key = "/var/lib/acme/cgit.lassul.us/key.pem";
};
};
users.users.blog = {
uid = genid "blog";
description = "lassul.us blog deployment";
home = "/srv/http/lassul.us";
useDefaultShell = true;
createHome = true;
openssh.authorizedKeys.keys = [
config.krebs.users.lass.pubkey
];
};
}